diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-01-05 14:17:44 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-01-05 14:17:44 -0500 |
| commit | ef69f2f2ab588ea51ade8587c8c0af2064c32c85 (patch) | |
| tree | 11c42db8941dfd8f4f2cc9a0f4ba61c07c7ba7c0 /changes | |
| parent | 13b2aa659833b52a62123cd0b3dc48caa7ee1019 (diff) | |
| parent | ccd8289958b6d81cd5575c15dc6c1218d8ecb2d0 (diff) | |
| download | tor-ef69f2f2ab588ea51ade8587c8c0af2064c32c85.tar.gz tor-ef69f2f2ab588ea51ade8587c8c0af2064c32c85.zip | |
Merge remote-tracking branch 'origin/maint-0.2.2'
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/bug4822 | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/changes/bug4822 b/changes/bug4822 new file mode 100644 index 0000000000..73f43f0452 --- /dev/null +++ b/changes/bug4822 @@ -0,0 +1,13 @@ + o Major security workaround: + - When building or running with any version of OpenSSL earlier + than 0.9.8s or 1.0.0f, disable SSLv3 support. These versions had + a bug (CVE-2011-4576) in which their block cipher padding + included uninitialized data, potentially leaking sensitive + information to any peer with whom they made a SSLv3 + connection. Tor does not use SSL v3 by default, but a hostile + client or server could force an SSLv3 connection in order to + gain information that they shouldn't have been able to get. The + best solution here is to upgrade to OpenSSL 0.9.8s or 1.0.0f (or + later). But when building or running with a non-upgraded + OpenSSL, we should instead make sure that the bug can't happen + by disabling SSLv3 entirely. |